drm: Add sanity checks to framebuffer creation

Perform some basic sanity check on some of the parameters in
drm_mode_fb_cmd2.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

1 files changed, 43 insertions, 4 deletions

diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 1b79c953b4cc..4d4e8b055731 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2185,6 +2185,47 @@ static int format_check(struct drm_mode_fb_cmd2 *r)
         }
 }
 
+static int framebuffer_check(struct drm_mode_fb_cmd2 *r)
+{
+        int ret, hsub, vsub, num_planes, i;
+
+        ret = format_check(r);
+        if (ret) {
+                DRM_ERROR("bad framebuffer format 0x%08x\n", r->pixel_format);
+                return ret;
+        }
+
+        hsub = drm_format_horz_chroma_subsampling(r->pixel_format);
+        vsub = drm_format_vert_chroma_subsampling(r->pixel_format);
+        num_planes = drm_format_num_planes(r->pixel_format);
+
+        if (r->width == 0 || r->width % hsub) {
+                DRM_ERROR("bad framebuffer width %u\n", r->height);
+                return -EINVAL;
+        }
+
+        if (r->height == 0 || r->height % vsub) {
+                DRM_ERROR("bad framebuffer height %u\n", r->height);
+                return -EINVAL;
+        }
+
+        for (i = 0; i < num_planes; i++) {
+                unsigned int width = r->width / (i != 0 ? hsub : 1);
+
+                if (!r->handles[i]) {
+                        DRM_ERROR("no buffer object handle for plane %d\n", i);
+                        return -EINVAL;
+                }
+
+                if (r->pitches[i] < drm_format_plane_cpp(r->pixel_format, i) * width) {
+                        DRM_ERROR("bad pitch %u for plane %d\n", r->pitches[i], i);
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
 /**
  * drm_mode_addfb2 - add an FB to the graphics configuration
  * @inode: inode from the ioctl
@@ -2224,11 +2265,9 @@ int drm_mode_addfb2(struct drm_device *dev,
                 return -EINVAL;
         }
 
-        ret = format_check(r);
-        if (ret) {
-                DRM_ERROR("bad framebuffer format 0x%08x\n", r->pixel_format);
+        ret = framebuffer_check(r);
+        if (ret)
                 return ret;
-        }
 
         mutex_lock(&dev->mode_config.mutex);